转载于MICROTIGER: Loading DLLs in Kernel Mode or User Mode

Loading DLLs in Kernel Mode or User Mode:

Windows CE 5.0 vs. Windows Embedded CE 6.0

One DLL cannot simultaneously load into both kernel mode and user mode. When you run an EXE or DLL, the code must be fixed up to run at its given address. For example, jumps within the code or references to global variables must be modified to refer to the right addresses. Because kernel DLLs load above 0x80000000 and user DLLs load below 0x80000000, it is impossible for a single copy of the DLL to be fixed up to both locations at once.

In Windows Embedded CE 6.0, the operating system bypasses this limitation by having two versions of some DLLs; one version to load in kernel mode, and one version to load in user mode. The kernel has a new standard of naming DLLs that load in both kernel mode and user mode. The kernel-mode version of the DLL has a “k.” at the beginning of the name. For example, the user-mode version of coredll is coredll.dll while the kernel-mode version is k.coredll.dll. The significance of the “k.” is that the kernel automatically translates kernel-mode accesses to user-mode DLLs into the proper kernel-mode version. For example, if a DLL is linked against the user-mode coredll.dll, as almost all DLLs in the build system are, then when that DLL is loaded into the kernel process, the DLL ends up importing from the kernel-mode k.coredll.dll instead. There is no load error in this case because the imports are seamlessly redirected to the kernel DLL. Similarly, if code inside the kernel process calls LoadLibrary on coredll.dll, it will actually load a reference to k.coredll.dll. This way, if it goes on to call GetProcAddress and call a function, it calls the proper kernel-mode function.

<script type="text/Javascript"> var ExpCollDivStr = ExpCollDivStr; ExpCollDivStr = ExpCollDivStr + "ctl00_LibFrame_ctl048409259,"; var ExpCollImgStr = ExpCollImgStr; ExpCollImgStr = ExpCollImgStr + "ctl00_LibFrame_ctl04img,"; </script> Ramifications of the DLL Loading Mechanism

In CE 6.0, if you implement DLLs, you do not need to go through your code and change coredll.dll references to k.coredll.dll references. In fact, Microsoft recommends that you do not, because it will destroy portability of your code to user mode. In the future, you may want to run your code in user mode instead of inside the kernel.

The kernel mode vs. user mode fixups also mean that OEMs may need to take steps to make their DLLs load one place or another, as explained with .bib file flags. There is also a “Z” flag which corresponds to the Windows CE 5.0 and prior versions “K” flag. “Z” cannot be combined with the compression flag “C”, while there are no such restrictions on “K” or “Q.” For more information, see

Binary Image Builder File.